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Epistemology of Intelligence Analysis 

In intelligence, epistemology is the study of the threat awareness and the way the threat is 
understood in the field of intelligence analysis. 

Most definitions of intelligence do not consider the fact that the epistemic normative 
status of the intelligence analysis is knowledge rather than a lower alternative. Counter- 
arguments to the epistemological status of intelligence are their purpose-oriented action, and 
their future-oriented content. (Ronn and Heffding 2013) 

Following the attacks of September 11, a terrorism commission was set up to identify the 
failures and weaknesses of US intelligence agencies, to learn from security vulnerabilities and to 


avoid future attacks on national safety and security. The conclusion was that the US intelligence 


institutions lacked the imagination and ability to make relevant predictions - that is to connect 
the relevant "points" and reach relevant conclusions. (Anderson, Schum, and Twining 2009) 

Sherman Kent, in Strategic Intelligence (1949), divides the field into three 
components:(Kent 1966) knowledge, organization, and activity. In the opinion of Michael 
Herman in /ntelligence Services in the Information Age (2001), the field of intelligence can be 
divided into: activity, subjects, product, and function. (Herman 2001)Scott and Jackson in The 
Study of Intelligence in Theory and Practice, introductory article in Intelligence and National 
Security Journal no. 19 of 2010, (Scott and Jackson 2004)complements Kent and Herman's 
divisions by providing an analysis of how to make significant distinctions in the field of 
intelligence. 

The intelligence contrasts with information and knowledge and can be placed in a 
pyramidal continuum of data, information and knowledge. (Dean and _ Gottschalk 
2007)Intelligence can be inserted into two different positions: either between information and 
knowledge, or at the top of the knowledge hierarchy. (Renn and Hoffding 2013) 

In the first case, the intelligence is an epistemic step above the information: Geoff Dean 
and Petter Gottschalk consider that "intelligence is placed between information and knowledge 
on the continuum as ideally intelligence represents (...) a form of validated information." (Dean 
and Gottschalk 2007)Normative understanding of intelligence can be seen as the most "plausible 
information." Intelligence is often referred to as "prior knowledge" understood as information 
and evaluation of future activities. (Wheaton and Beerbower 2006)Specifically, the pre-scientific 
attribute of the intelligence is characterized as a warning about events and potentially harmful 
actions. The question then is whether it disqualifies intelligence as knowledge. (Renn and 


Hoffding 2013) 


If the intelligence is placed above knowledge, it is more than mere knowledge. Jerry 
Ratcliffe justifies this ranking as follows: 
"So why the extra step of adding intelligence to the continuum? It is due to the fact that 
intelligence products are inherently action products. In other words, knowledge products 


can generate understanding, but intelligence products are supposed to generate 
action."(Ratcliffe 2008) 


This means that intelligence generates "actionable knowledge". But this interpretation, 
though claiming that intelligence is a type of knowledge, seems to confuse its epistemic status 
with its normative function, that of actions and decisions of orientation. 

According to Simon Heffding, when we compare the epistemic status of intelligence 
according to the above positions, the relationship between information and knowledge in 
continuum is asymmetric due to the different level of plausibility and relevance. (Renn and 
Hoffding 2013)However, what matters is the agent's propositional attitude towards the content of 
an information. In this sense, information and knowledge are interdependent, and both can thus 
be intelligence. 

The main concept of intelligence is the threat. This is reflected in the seminar work of J. 
David Singer in 1958, Threat Perception and the Armament-Tension Dilemma, (Singer 
1958)through a quasi-mathematical model: 

Threat-Perception = Estimated Capability x Estimated Intent 

Intent and capability parameters can be described as the dominant episteme used to 
understand the threat in the field of intelligence analysis. (Vandepeer 2011)Since only the threat 
actor is important from the ontological point of view, it means that for Singer only the intentions 
and abilities of the threat actor matter. 

Samuel Huntington, in The Soldier and the State (1957), claims that military personnel 


are qualified to assess their capabilities, but not their intentions. (Huntington 1981)Despite the 


changes that include non-state actors' assessments as a priority, the threat remains defined using 
only one model, focusing specifically on the threat actor. This assumes that analysts already 
know and understand the threat actor they are trying to assess. Threat evaluation is based on the 
knowledge and understanding of an actor. Identification is presumed. 

The Singer model was later extended by adding new parameters, of which the most 
common are vulnerability and opportunity. The vulnerability parameter focuses rather on the 
threat reference, resulting in vulnerability being defined as the susceptibility of a reviewer to an 
attack. Richard Pilch uses the following formula: (Howard and Sawyer 2003) 

Threat = Vulnerability x Capability x Intent 

One of the issues of the vulnerability parameter is that the more generic the target 
(referent) potential, the less correct will be the threat assessment. 

The opportunity parameter also appears as a complement to the conventional model: 

Threat = Intent x Capability x Opportunity 

Opportunity incorporates an understanding of both the threat actor and the referent and 
can be defined as a favorable time or opportunity for a threat actor in relation to a reviewer. 
(Vandepeer 2011) 

Despite efforts to incorporate additional parameters, the primary assumption is that the 
dominant episteme, with a primary focus on the threat actor, remains essential to assessing the 
threat. 

Investigation theory addresses different ways in which each type of investigation 
achieves its purpose. Bennets(Holsapple 2004) distinguishes between data, information and 
knowledge, stating that: 


"data is discrete, objective facts about events which include numbers, letters and images without 
context, while information is data with some level of meaning as it describes a situation 


or condition. Knowledge is built on data and information, and is created within the 
individual. This knowledge represents understanding of the context, insights into the 
relationships within a system and the ability to identify leverage points and weaknesses 
and to understand the future implications of actions taken to resolve problems." 


In order to produce objective intelligence, the analyst must use a process tailored to the 
nature of the problem, using one of the fundamental ways of reasoning: (Krizan 1999)induction 
(causality search, discovery of the relationships between the studied phenomena), deduction 
(general application, from general to specific), trained intuition (applying a spontaneous 
perspective, validated with available facts and tools), scientific method (hypothesis falsification 
and fictitious scenario testing). 

Induction: When analysts make a generalization or discover relationships between 
phenomena based on observations or other evidence. 

"Induction consists in establishing syllogistically a relation between one extreme and the middle 
by means of the other extreme, e.g. if B is the middle term between A and C, it consists 


in proving through C that A belongs to B. For this is the manner in which we make 
inductions."(Aristotle 1989, chap. 2.23) 


Stephen Marrin expands the inductive approach, indicating that analysts have an 
analytical approach in two stages. (Marrin 2012)They use intuitive "pattern and trend analysis" - 
identifying repetitive behavior over time, then relying on ad hoc rules or mental models derived 
from the study of relevant theory - for example, economics, political science or psychology - to 
determine the meaning of the model. (Duvenage 2010)Michael Collier argues that the inductive 
method leaves too much room for conjecture, superstition and opinion. 

Deduction: Judgment starting from general rules to specific cases, if the hypothesis is 
tested, contrary to the inductive reasoning where the hypothesis is created. 

”Whenever three terms are so related to one another that the last is contained in the middle as in 

a whole, and the middle is either contained in, or excluded from, the first as in or from a 

whole, the extremes must be related by a perfect syllogism. I call that term middle which 


is itself contained in another and contains another in itself: in position also this comes in 
the middle. By extremes I mean both that term which is itself contained in another and 


that in which another is contained. If A is predicated of all B, and B of all C, A must be 

predicated of all C: we have already explained what we mean by 'predicated of all’. 

Similarly also, if A is predicated of no B, and B of all C, it is necessary that no C will be 

A.” (Aristotle 1989, chap. 1.4) 

Krizan quotes Clauser and Weir (Krizan 1999) who warn that deductive reasoning should 
be used with care in the intelligence analysis, as there are rarely closed systems, thus premises 
based on another set of facts, applied to a new problem and supposed to be true may be false and 
lead to incorrect conclusions. 

Unlike deductive arguments, in inductive reasoning there is the possibility that the 
conclusion is false, even if all the premises are true. Instead of being valid or invalid, inductive 
arguments are strong or weak, which shows how likely it is that the conclusion is true. 

Abduction: The unofficial or pragmatic way of reasoning to describe how we "justify the 
best explanation" in everyday life. 

”We have Reduction (1) when it is obvious that the first term applies to the middle, but that the 
middle applies to the last term is not obvious, yet nevertheless is more probable [credible] 
or not less probable [credible] than the conclusion; or (2) if there are not many 
intermediate terms between the last and the middle; for in all such cases the effect is to 
bring us nearer to knowledge." (Aristotle 1989, chap. 2.25) 

Waltz asserts that abduction is, in intelligence, a practical description of an interactive 
analysis and synthesis set to arrive at a solution or explanation, creating and evaluating more 
hypotheses. (Waltz 2003, 173)In abduction, the analyst creatively generates a set of hypotheses 
and sets out to examine whether the available evidence is unequivocally supported by each other. 
The final step, namely testing the evidence, is a deductive inference. Abduction can be likened to 
the intuition of the analyst. This reasoning is erroneous because it is subject to cognitive errors 


but has the ability to extend the understanding of the intelligence matter beyond the original 


premises. 


Scientific method: It uses induction to develop the hypothesis, and deduction is used to be 
tested. If testing does not validate the hypothesis, a new hypothesis should be formulated, and 
new experiments designed to validate this hypothesis. (Marrin 2012)In the analysis of 
information there are no direct experiments and observations of the subject, but the analyst can 
develop hypotheses or explanations from information obtained from different sources. 
Hypotheses can then be examined for plausibility and iteratively tested against new information. 
(Duvenage 2010) 

Structural analysis: It represents additional tools for traditional and intuitive analysis 
methods and are not just alternatives. Using structural analysis methods could not only improve 
the quality of intelligence analysis but also enhance the credibility of the analysis that is often 
prone to criticism of actual or perceived politicization and other organizational pressures. Heuer 
and Pherson(Heuer and Pherson 2010) classifies 50 structural analytical methods in eight 
categories that correlate with common cognitive traps and indicates the functions that analysts 
have to meet to overcome these traps. Some of these methods are: 

e Decomposition and view: to exceed the limits of the working memory 

e Idea generation techniques: stimulating the analyst's mind with new possibilities to 
investigate and visualize an intelligence problem from different angles 

e Scenarios, indicators, bookmarks: identifying those who could change a situation and 
outlining the various possible scenarios 

e Generating and testing hypotheses: analysts, in the subconscious, hypothesize each 
information and validate them intuitively; structured analytical tools help to examine a 


wider range of alternative hypotheses, possibilities and explanations 


e Analysis of causes and effects: analysts should be cautious in unsafe assumptions and 
conclusions regarding the cause and effect of certain events or indicators 

e Reframing techniques: helps analysts to change their reference/mentality frameworks to 
an analytical problem by changing questions or perspectives 

e Challenge analysis techniques: helps deliver the best possible product to customers where 
there are major differences in views, highlighting minority views 

e Analysis of decision support: allows analysts to see the issue from the perspective of 
decision-makers. 
Biases: Biases can distort the correct application of inductive argumentation, thus 

preventing the formation of the most logical conclusion based on clues. Examples of such 


prejudices include availability heuristics, confirmation biases, and prediction biases. 
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